I have a network so configured: a router and a RPI that acts as wifi access point, dhcp and dns servers, firewall and gateway. The RPI is also connected with a OpenVpn client to a payed VPN service (NordVPN) so all the WiFi clients use the VPN connection.
I'm trying to create a private VPN so I can connect to the RPI also from outside. I run a VPN server on the RPI for this use. NordVPN does not provide port forwarding so I cannot connect to the RPI through the NordVPN IP address and I'm tryint to reach the RPI from the ISP public IP. I configured the port forwarding from the router to the RPI local IP address.
I'm able to connect with the private VPN to the RPI when the NordVPN connection is off but I cannot connect when the NordVPN connection is running.
I read the problem is the routing so I configured it and the maximum result reached is that I can do SSH from outside to the RPI when the NordVPN connection is runnging but I'm not able to connect with my OpenVPN client (with running NordVPN). The problem is that client and server do not complete the handshake. The server receive the first packet (I thing the firewall could be ok) but it is not able to send the reply (or it send through the wrong route). But it seems this problem there is not with SSH connection because it works from out (and I guess the server reply to the client handshake).
- 192.168.4.0/24 is the local client's network (rpi's wifi)
- 192.168.1.0/24 is the local router's network
- 192.168.1.1 is the router
- 192.168.1.117 is the RPI eht0
- 10.8.0.0/16 is the NordVPN tun0 network
- the payed VPN runs on standard OpenVPN port but the private VPN runs on different port
First, following here, I tried to forward from router to 192.168.1.117 with these routes on RPI.
ip rule add fwmark 65 table novpn ip route add default via 192.168.1.1 dev eth0 table novpn iptables -t mangle -A OUTPUT -p udp --sport 1234567 -j MARK --set-mark 65
In this case I was able to connect via private VPN only without NordVPN running.
Second, following here, I created a virtual eth0 interface (192.168.1.118). I forwarded from router to this new address and I configured the routes like this:
ip addr add 192.168.1.118 dev eth0:0 ip rule add from 192.168.1.118 table 1234 ip route add default via 192.168.1.1 dev eth0:0 table 1234
So I can connect via SSH from outside also when NordVPN connections is active but when I launch the private VPN client it is not able to complete handshake with these errors:
XXX.XXX.XXX.XXX:53347 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:53347, sid=5138c564 319ce197 Dec 08 23:02:55 rpi ovpn-server: XXX.XXX.XXX.XXX:53347 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Dec 08 23:02:55 rpi ovpn-server: XXX.XXX.XXX.XXX:53347 TLS Error: TLS handshake failed
I am on this problem since 2 weeks and I have definetly no other idea. Maybe someone could help me?
Thanks in advance.
PS: I do not write my iptables rules because they are a lot.
UPDATE: this is my server.conf
dev tun proto udp port PORT ca /etc/openvpn/easy-rsa/pki/ca.crt cert /etc/openvpn/easy-rsa/pki/issued/XXX.crt key /etc/openvpn/easy-rsa/pki/private/XXX.key dh none topology subnet server 10.35.0.0 255.255.255.0 # Set your primary domain name server address for clients push "dhcp-option DNS 188.8.131.52" push "dhcp-option DNS 184.108.40.206" # Prevent DNS leaks on Windows push "block-outside-dns" # Override the Client default gateway by using 0.0.0.0/1 and # 220.127.116.11/1 rather than 0.0.0.0/0. This has the benefit of # overriding but not wiping out the original default gateway. push "redirect-gateway def1" client-to-client keepalive 1800 3600 remote-cert-tls client tls-version-min 1.2 tls-crypt /etc/openvpn/easy-rsa/pki/ta.key cipher AES-256-CBC auth SHA256 user nobody group nogroup persist-key persist-tun crl-verify /etc/openvpn/crl.pem status /var/log/openvpn-status.log 20 status-version 3 syslog verb 3 #DuplicateCNs allow access control on a less-granular, per user basis. #Remove # if you will manage access by user instead of device. #duplicate-cn # Generated for use by PiVPN.io
and this is the private client conf
client dev tun proto udp remote ISP_IP PORT resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server tls-version-min 1.2 verify-x509-name XXX name cipher AES-256-CBC auth SHA256 auth-nocache verb 3
These are my routes:
$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.8.0.1 18.104.22.168 UG 0 0 0 tun0 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0 10.35.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1 22.214.171.124 10.8.0.1 126.96.36.199 UG 0 0 0 tun0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 NORDVPN_GW 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
The network topology is:
WIFI LAN CLIENTS (192.168.4.X) -> RPI (eth0 192.168.1.117, wlan0 192.168.4.1, tun0 NordVpn client 10.8.0.0/16, tun1 10.35.0.1 OpenVpn server) -> ROUTER (192.168.1.1) -> INTERNET
What I'd like to do:
OPENVPN CLIENT (10.35.0.2) -> INTERNET -> ROUTER -> RPI